Glonce

Atlassian Rovo flaws let prompt injection exfiltrate Jira and Confluence data

securityThe Glonce editorsHacker News🔥79Glonce rating79Impact72Novelty58Relevance100Surprise68Players65Credibility87
Atlassian Rovo flaws let prompt injection exfiltrate Jira and Confluence data

Atlassian's Rovo is a multi-purpose AI agent that operates across the company's product suite, including Jira and Confluence. PromptArmor says it identified vulnerabilities that let an attacker exfiltrate data across an entire Atlassian tenant through indirect prompt injection. The exploit needs no human-in-the-loop approval at any step, and it works by abusing Rovo's URL retrieval tool. It still succeeds even when an organization has turned off web search for Rovo, because that setting fails to remove the separate tool Rovo uses to open the search results it returns.

The attack chain begins when a hidden prompt injection reaches Rovo through one of several channels. PromptArmor says the most common is a file the victim uploads, calling it "quite common" for a user to find a file online and upload it to Rovo, but the technique does not depend on that specific source: external data already inside Atlassian such as support tickets, web data when search is enabled, or third-party connectors can carry the injection just as well. The victim then makes an ordinary request, such as asking Rovo to organize their Jira tickets. The hidden injection takes over from there, manipulating Rovo into appending the victim's Jira tickets and Confluence documents to a URL the attacker controls. Because Rovo's URL retrieval tool has no protections against opening a URL the agent itself dynamically constructed, Rovo requests that URL, and the attacker's web server logs the request along with the sensitive data appended to it, letting the attacker read the stolen ticket and document contents straight from those logs. A victim who returns to the chat afterward sees only the agent's suggested ticket updates, with no evidence that an attack took place. PromptArmor states the technique can exfiltrate any data the agent is able to access inside Atlassian, including data reachable only through third-party connectors.

PromptArmor also flags a second exfiltration path: Rovo renders Markdown images from AI-generated output, and PromptArmor describes insecure Markdown image rendering as a well-known technique for exfiltrating data through indirect prompt injection. The write-up points to examples from PromptArmor's own earlier research showing what a full attack chain looks like for that vector, but those examples are not reproduced in this piece.

PromptArmor says it reported the vulnerabilities to Atlassian on May 23rd. Atlassian opened a case and thanked PromptArmor for the report, but that was the last substantive contact: despite repeated follow-ups over more than two months, Atlassian never responded again, and Rovo was still vulnerable when PromptArmor published this account.

Key facts

  • PromptArmor identified vulnerabilities in Atlassian's Rovo AI agent that let indirect prompt injection exfiltrate data, including Jira tickets and Confluence documents, across an entire Atlassian tenant without any human-in-the-loop approval.
  • The exploit abuses Rovo's URL retrieval tool, which has no protections against opening a URL the agent itself constructs, so an injection can make Rovo append sensitive data to an attacker-controlled URL that the attacker later reads from its own web server logs.
  • The attack still succeeds even when an organization disables web search for Rovo, because that setting does not remove the separate tool Rovo uses to open search results.
  • Rovo's rendering of Markdown images from AI output is a second exfiltration path, since insecure Markdown image rendering is a well-known technique for exfiltrating data via indirect prompt injection.
  • PromptArmor disclosed the flaws to Atlassian on May 23rd; Atlassian opened a case and said thanks but sent no further communication despite multiple follow-ups over more than two months, and Rovo remained vulnerable when PromptArmor published.

Why it matters

This is a live, unresolved vulnerability in an AI agent that Atlassian has wired directly into Jira and Confluence, two systems that routinely hold sensitive internal data. The attack needs no human to approve anything, so a single manipulated file or ticket can quietly hand over ticket and document contents to an outside party while the interface shows nothing unusual. It also defeats what looks like a safety control: disabling Rovo's web search is not enough, because the tool that opens URLs stays active regardless.

Who it affects

Any organization running Atlassian Rovo across a Jira or Confluence tenant is exposed, since the injection can exfiltrate any data the agent can access, including data reachable only through third-party connectors. The hidden injection can arrive through an uploaded file, existing Atlassian content such as support tickets, web data, or a connector, so the risk is not confined to users who search the web through Rovo. The flaw sits in Rovo's own URL retrieval tool and Markdown image rendering, not in any customer's configuration, which is why disabling Rovo's web search setting does not close the gap.

How to use it

PromptArmor's write-up functions as a warning rather than a how-to: it names two concrete mechanisms, the insecure URL retrieval tool and insecure Markdown image rendering, so security teams evaluating or already running Rovo know specifically what to check for. The piece is explicit that turning off web search does not close the gap, which matters for anyone who assumed that setting was a mitigation. Atlassian had not confirmed a fix as of publication, so the URL retrieval and Markdown rendering paths described here should be treated as still open.

How solid is it

The account comes from a single source, PromptArmor, the firm that found the flaws, reported them, and is now publishing after Atlassian went quiet. PromptArmor documents the exchange in some detail, including that Atlassian opened a case and thanked them for the report, a concrete, checkable claim rather than a vague accusation. The piece does not give a CVE identifier, a CVSS severity score, or the exact count of vulnerabilities found beyond the source's plural wording, and it does not name an individual at either company, so several details a reader might want for independent verification are simply not present.

Risks and caveats

Atlassian has not publicly responded beyond the initial case acknowledgment: PromptArmor reports no further communication over more than two months despite multiple follow-ups, so it is unknown whether or when the issues will be fixed. The source gives no year for the May 23rd disclosure date, does not say how many distinct vulnerabilities exist beyond the plural wording, and references but does not include the promised examples of the Markdown image exfiltration technique from PromptArmor's earlier research. This is also PromptArmor's own account of its dealings with Atlassian; Atlassian's side of the exchange is not represented in the source.